V-286227

Discussion

Previous versions of MariaDB components that are not removed from the information system after updates have been installed may be exploited by adversaries. MariaDB may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. A transition period may be necessary when both the old and the new software are required.

Check Content

As a DBA, review installed MariaDB packages on the host operating system.

For RPM-based Linux distributions (e.g., RHEL, CentOS, Fedora), run:

rpm -qa | grep -i mariadb

For DEB-based Linux distributions (e.g., Debian, Ubuntu), run:

dpkg -l | grep -i mariadb

Review the output and verify that only the currently required MariaDB packages and versions are installed.

Confirm that the following have been removed following the upgrade:
- Outdated MariaDB packages.
- Superseded MariaDB versions.
- Unused MariaDB client libraries or components.

If any obsolete, superseded, or unnecessary MariaDB components remain installed on the system, this is a finding.